The exploit must work with latest WordPress, default install, ..

Hm, when will Site Editing be in latest WordPress? $-)